How to Deploy Apps Using Winget with Microsoft Intune

Before deploying applications via winget, ensure the Windows Package Manager is installed on your target devices. While winget comes pre-installed on newer Windows versions, many enterprise devices may need it deployed through Intune.

Navigate to the Microsoft Intune admin center at https://endpoint.microsoft.com and sign in with your administrator credentials.

Go to Apps > All apps > Add > Microsoft Store app (new). In the package identifier field, enter:

9NBLGGH4NNS1

This is the official package ID for Microsoft App Installer, which includes winget. Configure the app details:

• Name: Microsoft App Installer
• Description: Windows Package Manager for enterprise app deployment
• Publisher: Microsoft Corporation
• Category: Productivity

Under Assignments, click Add group and select All Devices. Set the assignment type to Required and ensure it deploys in device context.

winget --version
Get-AppxPackage -Name "Microsoft.DesktopAppInstaller"

You should see the winget version number and the App Installer package details.

Configure the official Microsoft winget repository as a trusted source within Intune to enable direct app selection and deployment.

In the Intune admin center, navigate to Apps > App sources > Add > Windows Package Manager.

Configure the repository settings:

• Name: Microsoft Store (winget)
• Repository URL: https://cdn.winget.microsoft.com/cache
• Enable automatic updates: Yes
• Update frequency: Daily

Click Add to save the configuration. This establishes the connection to Microsoft's official winget repository, allowing Intune to pull the latest package information.

Use Intune's native winget integration to deploy applications directly from the Windows Package Manager repository. This method provides the cleanest deployment experience with automatic update capabilities.

Navigate to Apps > All apps > Add > Windows app (Win32) > Select from Windows Package Manager.

Search for your desired application. For example, search for "Google Chrome" and select the appropriate package. Configure the application details:

• Name: Google Chrome Enterprise
• Publisher: Google LLC
• Category: Productivity
• Show in Company Portal: Yes
• Information URL: https://www.google.com/chrome/

Under Program settings, the install and uninstall commands are automatically populated:

Install command: winget install --exact --id Google.Chrome --scope machine --silent
Uninstall command: winget uninstall --exact --id Google.Chrome --scope machine --silent

Configure Requirements:

• Operating system architecture: x64
• Minimum operating system: Windows 10 1709

Set up Detection rules using the registry method:

• Rule type: Registry
• Key path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
• Detection method: Key exists

For applications not available through direct integration or when you need custom installation logic, create PowerShell scripts that leverage winget commands.

Create a new PowerShell script file named Install-NotepadPlusPlus.ps1:

# Install Notepad++ via winget
$AppID = "Notepad++.Notepad++"
$LogPath = "C:\Windows\Temp\WingetInstall.log"

# Check if winget is available
try {
    $WingetVersion = winget --version
    Write-Output "Winget version: $WingetVersion" | Out-File -FilePath $LogPath -Append
} catch {
    Write-Error "Winget not found. Ensure Microsoft App Installer is installed."
    exit 1
}

# Install the application
try {
    Write-Output "Installing $AppID..." | Out-File -FilePath $LogPath -Append
    $InstallResult = winget install --id $AppID --scope machine --silent --accept-package-agreements --accept-source-agreements
    
    if ($LASTEXITCODE -eq 0) {
        Write-Output "Installation successful" | Out-File -FilePath $LogPath -Append
        exit 0
    } else {
        Write-Output "Installation failed with exit code: $LASTEXITCODE" | Out-File -FilePath $LogPath -Append
        exit $LASTEXITCODE
    }
} catch {
    Write-Error "Installation failed: $_"
    Write-Output "Installation error: $_" | Out-File -FilePath $LogPath -Append
    exit 1
}

Create a corresponding detection script Detect-NotepadPlusPlus.ps1:

# Detection script for Notepad++
$AppID = "Notepad++.Notepad++"

try {
    $InstalledApps = winget list --id $AppID 2>$null
    if ($InstalledApps -match $AppID) {
        Write-Output "Application found"
        exit 0
    } else {
        exit 1
    }
} catch {
    exit 1
}

Convert your PowerShell scripts into Win32 app packages that can be deployed through Intune's application management system.

Download the Microsoft Win32 Content Prep Tool from the official Microsoft repository. Create a source folder structure:

C:\WingetApps\NotepadPlusPlus\
├── Install-NotepadPlusPlus.ps1
├── Detect-NotepadPlusPlus.ps1
└── install.cmd

Create an install.cmd wrapper file:

@echo off
powershell.exe -ExecutionPolicy Bypass -File "%~dp0Install-NotepadPlusPlus.ps1"
exit %ERRORLEVEL%

Use the IntuneWinAppUtil.exe to create the package:

IntuneWinAppUtil.exe -c "C:\WingetApps\NotepadPlusPlus" -s "install.cmd" -o "C:\WingetApps\Output"

In Intune admin center, go to Apps > All apps > Add > Windows app (Win32). Upload the generated .intunewin file and configure:

• Install command: install.cmd
• Uninstall command: winget uninstall --id Notepad++.Notepad++ --scope machine --silent
• Install behavior: System
• Device restart behavior: No specific action

Configure detection rules using Custom script and upload your Detect-NotepadPlusPlus.ps1 file.

Set requirements:

• Operating system architecture: x64
• Minimum operating system: Windows 10 1709
• PowerShell script: Not required (we use cmd wrapper)

Set up automated update policies and maintenance schedules to keep your winget-deployed applications current across your organization.

Navigate to Device configuration > Profiles > Create profile > Settings catalog. Search for "Windows Package Manager" policies and configure:

{
  "WindowsPackageManager": {
    "EnableAutoUpdateCheck": true,
    "AutoUpdateCheckFrequency": "Daily",
    "AllowExperimentalFeatures": false,
    "EnableLocalManifests": false,
    "EnableMSStoreSource": true,
    "EnableDefaultSource": true,
    "EnableAdditionalSources": false
  }
}

Create a PowerShell script for scheduled updates Update-WingetApps.ps1:

# Automated winget update script
$LogPath = "C:\Windows\Temp\WingetUpdates.log"
$UpdateList = @(
    "Google.Chrome",
    "Notepad++.Notepad++",
    "Microsoft.VisualStudioCode"
)

Write-Output "Starting winget update process - $(Get-Date)" | Out-File -FilePath $LogPath -Append

# Update winget sources
winget source update

# Check for and install updates
foreach ($App in $UpdateList) {
    try {
        Write-Output "Checking updates for $App" | Out-File -FilePath $LogPath -Append
        $UpdateResult = winget upgrade --id $App --scope machine --silent --accept-package-agreements
        
        if ($LASTEXITCODE -eq 0) {
            Write-Output "$App updated successfully" | Out-File -FilePath $LogPath -Append
        } elseif ($LASTEXITCODE -eq -1978335189) {
            Write-Output "$App is already up to date" | Out-File -FilePath $LogPath -Append
        } else {
            Write-Output "$App update failed with code: $LASTEXITCODE" | Out-File -FilePath $LogPath -Append
        }
    } catch {
        Write-Output "Error updating $App: $_" | Out-File -FilePath $LogPath -Append
    }
}

Write-Output "Update process completed - $(Get-Date)" | Out-File -FilePath $LogPath -Append

Deploy this as a Proactive Remediation or scheduled PowerShell script to run weekly. Go to Devices > Scripts > Add > Windows 10 and later:

• Run this script using the logged on credentials: No
• Enforce script signature check: No
• Run script in 64-bit PowerShell: Yes

Implement comprehensive monitoring and troubleshooting procedures to ensure successful winget deployments across your organization.

In Intune admin center, navigate to Apps > Monitor to access deployment analytics:

• App install status: Shows success/failure rates per application
• Device install status: Per-device deployment results
• User install status: User-specific installation data

Create a PowerShell monitoring script Monitor-WingetDeployments.ps1:

# Winget deployment monitoring script
$LogPath = "C:\Windows\Temp\WingetMonitoring.log"
$ReportPath = "C:\Windows\Temp\WingetReport.json"

# Get winget version and status
$WingetInfo = @{
    Version = (winget --version 2>$null)
    Sources = (winget source list 2>$null)
    InstalledApps = @()
    LastCheck = (Get-Date).ToString()
}

# Get list of winget-installed applications
try {
    $InstalledList = winget list --source winget 2>$null
    if ($InstalledList) {
        $WingetInfo.InstalledApps = $InstalledList -split "`n" | Where-Object { $_ -match "\w+" } | Select-Object -Skip 2
    }
} catch {
    Write-Output "Error getting installed apps: $_" | Out-File -FilePath $LogPath -Append
}

# Check Intune Management Extension service
$IMEService = Get-Service -Name "Microsoft Intune Management Extension" -ErrorAction SilentlyContinue
$WingetInfo.IMEStatus = if ($IMEService) { $IMEService.Status } else { "Not Found" }

# Export report
$WingetInfo | ConvertTo-Json -Depth 3 | Out-File -FilePath $ReportPath -Encoding UTF8

Write-Output "Monitoring report generated: $ReportPath" | Out-File -FilePath $LogPath -Append

Common troubleshooting steps for failed deployments:

1. Check winget availability:

   winget --version
   Get-AppxPackage -Name "Microsoft.DesktopAppInstaller"

2. Verify network connectivity:

   Test-NetConnection -ComputerName "cdn.winget.microsoft.com" -Port 443
   winget source list

3. Check Intune Management Extension logs:

   Get-ChildItem "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs" | Sort-Object LastWriteTime -Descending | Select-Object -First 5